NQE Discussions

This query takes the rather limited show mlag config-sanity command from an arista switch and generates a violation if it does not match the output below.switch#show mlag config-sanityNo global configuration inconsistencies found.No per interface configuration inconsistencies found.The query identifies each line of the output and then creates two variables globalConfig  and interfaceConfig, interfaceConfig is identified by check if interface exists in the line. I am only expecting two lines therefore both variables once set won’t be added to.   Watch this space if this changes I will update the query.As in my previous queries I have included the extract that is in my “Arista Library” into the query for simplicity.Finally there maybe a better way to do this as I had some fun and games getting this one to work so any feedback is gratefully appreciated./** * @intent Mlag Config Sanity Check

This NQE uses the show mlag detail command which all that it should be in command.type of MLAG_STATE it did not appear so I added it as a custom command and will violate if the following occur:What I alert on:Mlag state is not AcitveNegotiate Status is not connectedPeer Config is not ConsistentPeer Link and/or local interface are not upIf both the local and peer device are both primary or both secondary admittedly the latter may be impossible but though of capturing it just in case Peer Link is error disabled.If the Agent is not showing as ruinning.What we warn on:We will also Warn on the following:If there any ports disabled, Inactive or Active PartialIf the number of port disabled, inactive or Active partial is the same as the total number of ports configured. /** * @intent Check the MLAG status * @description

Using the “show vxlan config-sanity detail” command as a custom command we have a built a query that enables you to verify your vxlan configuration based on the “Result” field being anything other than “OK”, if you wish to accept warnings then simply adjust the relevant if statement in the “AristaVxLanSanity” section of this script./** * @intent Report on the Sanity of VXLAN configuration * @description Using the AristaVxlanSanity module of the Arista Library we will report any vxlan * configuration failures by category per device using the default assumptions of the Module * from the library */AristaVxlanSanity(device: Device) =foreach command in device.outputs.commands where command.commandText == "show vxlan config-sanity detail" //Retrieve only the command show vxlan config-sanity detail let deviceName = device.name let vxlanResponse = command.response let pa

I have raised a support case for this as well, but I was wondering if anyone had seen it when you see different behavior when running a query in the library versus verify.I have created a query to display the vxlan address table, and when run in Verify the result shows 0 however when executed int he library it produces the complete list of passed entries as expected.The Query will always pass and has been added to verify so we can do a diff check on the VXLAN Address table during changes as requested by the engineers.Has anyone else experienced this, or got any suggestions on how to address this.Results from execution in Verify:Results from execution in Library (Sanitized):

Hello,I am trying to create the NQE query, where i want to see the outputs of show module, show platform, depending upon the platform command might be different and then from those outputs i want to see the modules which are in down state.

Any time someone tells me they’re manually reviewing ACLs for compliance, I know they’re fighting a losing battle. That approach might work on a small network, but once you’re dealing with thousands—or tens of thousands—of devices, manual validation simply doesn’t scale. This came up recently in a conversation on specific ACL compliance requirement across an environment. They weren’t looking for advanced analytics or a flashy dashboard. They needed a reliable way to ensure their access control lists consistently met two basic security rules, everywhere, all the time. The compliance problem The first requirement was that every deny statement in an ACL must log. From a security and compliance standpoint, a deny that isn’t logged is effectively invisible. Traffic may be blocked, but without a log entry there’s no audit trail and no way to prove enforcement. The second requirement was that

  The new ordered collections feature streamlines how you pull, organize, and present data from your inventory. It helps you quickly surface results—like the top 10 most vulnerable devices—organized the way you want, so you can act faster and share clearer insights with your team.Let’s walk through what ordered collections can do, when they’re most useful, and how to use the new syntax to save time and reduce manual filtering. Introduction: Why Ordered Collections MatterBefore ordered collections, finding and organizing your top results (say, the most vulnerable devices) meant extra filtering and sorting. Reports could show too many results, scattered by category, forcing you to click around or explain sorting steps to others. Now, ordered collections make it easy to: Limit results to exactly what you want (lik

In support of ongoing federal cybersecurity and supply-chain risk management initiatives, Forward Networks has developed a streamlined detection workflow for identifying devices manufactured by Huawei, ZTE, TP-Link or any other network device of concern that are within an enterprise or government environment.This proactive measure aligns with Cybersecurity and Infrastructure Security Agency (CISA) guidance and the Federal Zero Trust Architecture (ZTA) implementation goals outlined in OMB Memorandum M-22-09. This capability helps agencies rapidly locate unapproved or unmanaged devices—enhancing visibility, compliance, and operational integrity across complex network infrastructures. What’s Going OnBecause consumer network dev

The default number of results returned for an NQE query executed from the API is 1000 (returned as a list assigned to the key “items”)You can increase the limit to 10,000 items. For retrieving results of more than 10,000 items, you will need to use the limit and offset parameters as part of your script, and concatenate the results of multiple API calls within the script.Below is a simple script in Python that concatenates successive chunks of 10,000 items into a single output:import requestsdef nqe_query_with_offset(): my_result = [] limit= 10000 offset = 0 network_id = "101" url = "https://fwd.app/api/nqe?networkId=" + network_id total_extracted = False while total_extracted == False: payload ={"queryId": "FQ_ac651cb2901b067fe7dbfb511613ab44776d8029", "queryOptions": { "limit": limit, "offset": offset}} print(payload)

The Framework Regional Variations Determining a Device’s Region Changing Variables Based on Region Knowing the Collection State Anatomy of a test Imports Pattern Matching Function Exceptions

You may often want to find all pattern matches within the device configuration and filter the results based on a regular expression.The following NQE query uses a regex filter as part of a two step process in the getMatch(device) function.First, we find peer-group names in a Cisco BGP configuration and stores each match in a string called groupName by matching on the pattern defined at the top of the query.Second, we iterate through each each pattern match and filter the groupName based on the regex `^PUBLIC.*(?:-4|-X)$`The regex matches a string that starts with the word “PUBLIC” and end with either “-4” or “-X”.The main foreach loop at the bottom of the query applies the function getMatch to output a list of devices along with all the matching peer group names pattern = ```router bgp {number} neighbor {groupName: string} peer-group```;

You can use the NQE group function to collapse rows that have multiple matching columns.In the following example, we make a list of all devices in the network (and store in a list called data), and group all the devices in data together that have matching values for Vendor, Model, OS, and OS Version. The matching values are grouped by attributes.Note that list stored in data just has device names. We don’t actually list all the device names within the select statement. The device is the identifier for each unique element that is hidden when you use the group function. We access the list of devices in each group (within the list data) with a foreach loop in order to count the unique items and provide a total in the last column./** * @intent List devices grouped by matching Vendor, Model, OS, and Version and the to

This NQE extracts the config for each ACL, accounting for all syntaxes used in Cisco devices. The order is determined by the line number, which is used to compare the line of the deny statement with the last line of the ACL config and returns the failures by device and ACL name.standard(config) = foreach match in patternMatches(config, `access-list {aclName:string} {!"remark"}`) group match.line as config by match.data.aclName as name select { name, config };nested(config) = foreach match in patternMatches(config, `ip access-list {string} {name:string}`) let config = (foreach line in match.line.children where !hasMatch(line.text, re`.*remark.*`) select line) select { name: match.data.name, config };foreach device in network.devicesforeach acl in standard(device.files.config) + nested(device.files.config)let maxLine = max(foreach line in acl.config

Hello:   Hopefully this isnt a repeat as i couldn’t find the answer on here so I wanted to post it.  im trying to match against “tags” within  the application, and everything I am tying, regarding the ‘where matches” command is used, isnt working.  This is in the regular inventory so i have the statement “foreach device in network.devices” list as well above where i think the match line should go.  I can it list the tags, just not match/filter on tags.

 In this video, I demonstrate how Forward Enterprise replaces Infoblox NetMRI, which has now reached its Last Order Date (April 30, 2025) and will go end of support in April 2027. Many teams are looking for a solution that not only replaces NetMRI but also takes them far beyond its limitations — and that’s exactly what Forward provides. Here are a few highlights from the video:A true network digital twin: Forward mathematically models your entire environment — devices, topology, and paths — so you can validate intent, detect drift, and troubleshoot with precision.  

Avoiding device management being exposed on interfaces to the internet is something that we all want to avoid, but if such an exposure was to occur wouldn’t you want to know?This query inspects all interfaces and specifically checks whether http, https, fgfm (FortiManager), snmp, and SSH are enabled via the set allowaccess command.  To run this check you’ll need to configure a custom command.Custom Command Required.show system interfacesThe Query:/** * @intent Do not present fgfm, SSH, HTTPS on the internet ports * @description Check all interfaces that face the internet to ensure * "SSH","HTTPS" and "fgfm" are not present. Example Interface: edit "mgmt1" set vdom "root" set ip 169.254.255.2 255.255.255.255 set allowaccess ping https ssh snmp set status down set type phy

This is to discuss a common practice with the use of the interface Description field.It is really common to look at CDP or LLDP and find the neighbor device name, then put that remote device name into the interface Description of the interface that connects these two devices together.  It is also common to add the remote device interface as well./** * @intent Verify if the interface description includes the device name of the linked device * @description Use the Link element of the data model to determine the device name and interface * of a networking device that is connected to this interface. * Verify that the remote device name and remote interface an included in the interface Description. */export getL3Interfaces(device: Device) =  foreach iface in device.interfaces  where length(iface.links) > 0  foreach ifaceIpInfo in getSvis(iface) + getSubIfaces(iface)  sele

Chinese state-sponsored threat actors are targeting network infrastructure worldwide, leveraging compromised routers and edge devices to establish long-term persistence and exfiltrate sensitive data. A recent joint cybersecurity advisory from NSA, CISA, FBI, and international partners highlights the scale of this threat and provides detailed mitigation guidance.At Forward Networks, we’ve created a purpose-built NQE query to help customers quickly identify two of the most common risks associated with this campaign:Known exploited vulnerabilities

OverviewWorking with IP addresses in NQE opens up all kinds of possibilities, but it’s not always clear what tools are available out of the box. I’ve worked with several customers who wanted to do everything from filtering IPv6 neighbors to calculating subnet utilization across thousands of devices—and the good news is, NQE makes a lot of this simpler than you might expect.In this post, I’m sharing five of my favorite IP address-related techniques that you might not know about, along with tips for using them in your own queries. 1. Use toNumber() to Compare IP AddressesWhen you want to compare IP addresses (e.g., sort them, find the lowest one

In dynamic network environments, engineers often make quick changes directly to a device’s running configuration to resolve issues or apply updates. But if those changes aren’t saved to the startup configuration, they’ll be lost on the next device restart—potentially causing outages or security gaps.This oversight can lead to:Devices booting with outdated configurations   Outages and service disruptions   Security vulnerabilities if critical policy changes aren’t retained  Manually verifying that all running configs are saved can be time-consuming and error-prone, especially in large environments. Forward Networks’ Network Query Engine (NQE) simplifies this process by automatically comparing the running and sta

Forward NQE includes several under-the-hood optimizations that can improve query performance. This post focuses on the _lookup optimization, which can reduce execution time when filtering on a single key field using an exact equality comparison. Leveraging _lookup is considered a best practice whenever possible.In a recent query I wrote joining device CVE information with the EPSS database in a network containing 10,000 devices, re-writing the NQE to take advantage of _lookup reduced the execution time by over 50%. While this kind of optimization isn’t as dramatic as parallelization—where a multi-minute query might drop to seconds—it can still offer a significant and worthwhile improvement, particularly in queries with repeated key-

When an NQE runs in parallel, it executes the same logic across all devices in the snapshot inventory simultaneously, rather than one device at a time in sequence. In practice, this can be the difference between a query that risks hitting the 20-minute timeout and one that completes in a fraction of the time. When Parallelization HappensA query will run in parallel if:It starts with an iteration over network.devices It does not access network.devices in any other way (only one iteration) It does not access network.endpoints It does not use the group … by qualifierHow to Check

I am looking for for BGP protocol which will show below details: device nameNeighborAddressoutbound Interface descriptionpeerDeviceName peerVrfpeer outbound Interface descriptionsessionState: neighbor.sessionStatepeerType (Internal/External) The one I created, but its not loading:import "@fwd/L3/Interface Utilities"; //getL3Interfaces(device: Device)getPeerInfo(neighbor, sourceRouterId) =  max(foreach device in network.devices      where device.name == neighbor.peerDeviceName      let l3IfaceList = getL3Interfaces(device)      foreach networkInstance in device.networkInstances      foreach protocol in networkInstance.protocols      where isPresent(protocol.bgp)      let bgp = protocol.bgp      foreach neighbor in bgp.neighbors      where neig

The following NQE query lists all the IP addresses that are part of a NAT rule on any device in the network./** * @intent List all NAT entries * @description List all NAT entries, including post NAT IPs */foreach device in network.devicesforeach natEntry in device.natEntrieslet headerMatches = natEntry.headerMatcheslet ipv4SrcSubnets = natEntry.headerMatches.ipv4Srclet ipv4DstSubnets = natEntry.headerMatches.ipv4Dstlet ipv4NatSrcSubnets = (foreach rewrite in natEntry.rewrites select rewrite.ipv4Src)let ipv4NatDstSubnets = (foreach rewrite in natEntry.rewrites select rewrite.ipv4Dst)where isPresent(max(ipv4NatSrcSubnets)) || isPresent(max(ipv4NatDstSubnets))select { deviceName: device.name, "NAT type": natEntry.natType, "Source IP": ipv4SrcSubnets, "Destination IP": ipv4DstSubnet

I see the filter function and count function shows as unknown functions in NQE query. Please help with appropriate functions for these two. I need to count the total number of interfaces in a devices and interfaces operational status DOWN in state.